diff options
| -rw-r--r-- | sys/dev/an/if_an.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/sys/dev/an/if_an.c b/sys/dev/an/if_an.c index ee40c69..b5b9881 100644 --- a/sys/dev/an/if_an.c +++ b/sys/dev/an/if_an.c @@ -3777,6 +3777,9 @@ flashcard(struct ifnet *ifp, struct aironet_ioctl *l_ioctl) return ENOBUFS; break; case AIROFLSHGCHR: /* Get char from aux */ + if (l_ioctl->len > sizeof(sc->areq)) { + return -EINVAL; + } AN_UNLOCK(sc); status = copyin(l_ioctl->data, &sc->areq, l_ioctl->len); AN_LOCK(sc); @@ -3788,6 +3791,9 @@ flashcard(struct ifnet *ifp, struct aironet_ioctl *l_ioctl) else return -1; case AIROFLSHPCHR: /* Send char to card. */ + if (l_ioctl->len > sizeof(sc->areq)) { + return -EINVAL; + } AN_UNLOCK(sc); status = copyin(l_ioctl->data, &sc->areq, l_ioctl->len); AN_LOCK(sc); |
